Seals
Concept: Seals & integrity.
Personal seal — /api/v1/seals (authenticated)
Section titled “Personal seal — /api/v1/seals (authenticated)”| Method · Route | Purpose | Source |
|---|---|---|
POST / | Register a seal. OwnerId is always the authenticated user (client input ignored); OwnerType = User or Organization, with a security Tier. | SealEndpoints.cs:28 |
DELETE /{credentialId} | Revoke a seal (by owner + ownerType). | :65 |
POST /check | Pre-flight: a personal seal needs only email + first passkey (Owner default policy; KYC gating is org-level). | :211 |
Seal registry — GET /api/org/{slug}/seals
Section titled “Seal registry — GET /api/org/{slug}/seals”Returns the org’s seals (:90):
- Master seal — one row if
Organization.OrgSealKeyIdis set ("{org} Master Seal", scopeALL (ROOT)). - Personal seals — each active member’s
UserCredential(s) surfaced as personal seals (one row per passkey; the first is the semantic personal seal).
Bind personal → master (sole proprietorship)
Section titled “Bind personal → master (sole proprietorship)”POST /api/org/{slug}/master-seal/bind-personal (:164) — for an independent sole proprietorship whose Owner had no passkey at org-creation time. After the Owner registers a passkey, this binds their first UserCredential as the org master seal. Owner-only; rejected if a master seal is already set (seals are immutable).